WO2024029666A1

WO2024029666A1 - Email security system for blocking and responding to targeted email attack and operation method therefor

Info

Publication number: WO2024029666A1
Application number: PCT/KR2022/019497
Authority: WO
Inventors: 김충한
Original assignee: (주)기원테크
Priority date: 2022-08-04
Filing date: 2022-12-02
Publication date: 2024-02-08
Also published as: JP2024533008A

Abstract

An operation method for an email security system comprises the steps of: configuring security threat information synchronization data by synchronizing targeted email security threat information configured by performing a targeted email security threat inspection of a received mail with targeted email security threat information configured by performing a targeted email security threat inspection of a sent mail; performing a targeted email security threat inspection corresponding to a newly received mail or a newly sent mail, by using the security threat information synchronization data; and performing targeted email security threat response processing according to the targeted email security threat inspect of the newly received mail or the newly sent mail.

Description

Email security system and method of operation for blocking and responding to targeted email attacks

The present invention relates to an email security system and method of operating the same for blocking and responding to targeted email attacks.

With the development of network attack technology, cyber attacks via email are gradually evolving in modern society. The increasing activity of targeted malicious emails, so-called targeted email attacks, through sophisticated cyberattack tactics using malware and social engineering, is impacting active Internet users and businesses around the world.

These targeted email attacks, unlike spam phishing attacks that target an unspecified number of people, include attacks that target individuals or companies and then target specific people to damage or damage the target's information assets.

To carry out targeted email attacks, threat actors gather information and create realistic-looking personalized email messages to persuade targets to respond, ultimately creating a security hole.

Furthermore, targeted attacks used on incoming (inbound) and outgoing (outbound) emails use header forgery, pseudo-email addresses, or account takeover (ATO) to attach unknown, intelligent malware or send messages from legitimate senders trusted by the target. By using sophisticated and unknown methods, such as spoofing, victims are tricked into responding to emails by clicking on attachments or sending replies containing personal information, with the attackers' intention to send incorrect transfers, data leaks, or computer system failures. do.

This can pose a serious risk to the victim's information assets. However, compared to the severity of these targeted email attacks, the email security solutions proposed to date are limited to fragmentary technologies such as simple inbound spam blocking and inbound domain blocking, and target email attacks by comprehensively utilizing known technologies. Solutions that effectively prevent or block have not been proposed.

In particular, targeted email attacks on the receiving (inbound) side ultimately lead to security problems for sending (outbound), and problems with sending security also lead to receiving security problems, so take this into consideration comprehensively. There is a need for a systematic security system to block targeted email attacks, but no appropriate solution has been proposed.

The present invention was created to solve the problems described above, and effectively blocks targeted email attacks through a step-by-step targeted email attack threat inspection process for inbound and outbound mail, and provides an appropriate response process and diagnosis. The purpose is to provide an email security system device and operation method for blocking and responding to targeted email attacks that can provide reporting.

The method of operating an email security system according to an embodiment of the present invention to solve the above-described problems includes targeting email security threat information constructed by performing a targeted email security threat check of incoming mail, and targeting email security threat information of outgoing mail. Constructing security threat information synchronization data by synchronizing targeted email security threat information configured according to the performance of email security threat screening; Using the security threat information synchronization data, performing a targeted email security threat check corresponding to new received mail or new sent mail; And performing targeted email security threat response processing according to the targeted email security threat inspection of the new received mail or the new sent mail, and performing targeted email security threat response processing in response to the new received mail or the new sent mail. The inspection includes at least one of a spam attack threat inspection targeting a specific email account, a malware email attack threat inspection, a social engineering email attack threat inspection, and an email information leakage threat inspection using the security threat information synchronization data.

A service providing device using an email security system according to an embodiment of the present invention to solve the above-mentioned problems includes targeted email security threat information constructed by performing a targeted email security threat check of incoming emails, and information on outgoing emails. a security threat information synchronization processing unit that synchronizes targeted email security threat information configured according to the performance of a targeted email security threat scan to form security threat information synchronization data; a targeted email security threat inspection unit that uses the security threat information synchronization data to perform a targeted email security threat inspection corresponding to newly received or newly sent mail; And a mail processing unit that performs targeted email security threat response processing according to the targeted email security threat inspection of the new received mail or the new sent mail, and targeted email security corresponding to the new received mail or the new sent mail. The threat check includes at least one of a spam attack threat check targeting a specific email account, a malware email attack threat check, a social engineering email attack threat check, and an email information leakage threat check using the security threat information synchronization data. .

Meanwhile, the method according to an embodiment of the present invention for solving the above-described problem may be implemented with a computer-readable recording medium for executing the method on a computer and a computer program stored in the recording medium.

According to an embodiment of the present invention, targeted email security threat information configured according to the performance of a targeted email security threat check of incoming mail and targeted email security threat information configured according to the performance of a targeted email security threat check of outgoing mail are synchronized. By configuring security threat information synchronization data and using the security threat information synchronization data, a targeted email security threat check corresponding to new incoming or new outgoing mail is performed step by step, thereby creating an effective targeted email attack threat. Can handle inspection process.

Accordingly, the present invention is a targeted email attack that can effectively block targeted email attacks and provide appropriate diagnostic reporting and response processes through a step-by-step targeted email attack threat inspection process for inbound and outbound mail. An email security system device and method of operation for blocking and responding to attacks can be provided.

1 is a conceptual diagram schematically showing the entire system according to an embodiment of the present invention.

Figure 2 is a block diagram for explaining a service providing device according to an embodiment of the present invention.

3 and 4 are block diagrams to explain in more detail some configurations of a service providing device according to an embodiment of the present invention.

Figures 5 and 6 are flowcharts for explaining a service process using a system according to an embodiment of the present invention.

Figure 7 is a diagram for explaining a large file leak detection process according to an embodiment of the present invention.

Figure 8 is a ladder diagram to explain a policy-based approval process for large files according to an embodiment of the present invention.

The following merely illustrates the principles of the invention. Therefore, those skilled in the art will be able to invent various devices and methods that embody the principles of the present invention and are included in the concept and scope of the present invention, although not explicitly described or shown herein. In addition, all conditional terms and examples listed herein are, in principle, expressly intended only for the purpose of enabling the concept of the invention to be understood, and should be understood not as limiting to the examples and states specifically listed as such. do.

Additionally, it is to be understood that any detailed description reciting the principles, aspects and embodiments of the invention, as well as specific embodiments, is intended to encompass structural and functional equivalents thereof. In addition, these equivalents should be understood to include not only currently known equivalents but also equivalents developed in the future, that is, all elements invented to perform the same function regardless of structure.

Accordingly, for example, the block diagrams herein should be understood as representing a conceptual view of an example circuit embodying the principles of the invention. Similarly, all flow diagrams, state transition diagrams, pseudo-code, etc. are understood to represent various processes that can be substantially represented on a computer-readable medium and are performed by a computer or processor, whether or not the computer or processor is explicitly shown. It has to be.

Additionally, the clear use of terms such as processor, control, or similar concepts should not be construed as exclusively referring to hardware capable of executing software, and should not be construed as referring exclusively to hardware capable of executing software, including, without limitation, digital signal processor (DSP) hardware, and ROM for storing software. It should be understood as implicitly including ROM, RAM, and non-volatile memory. Other hardware for public use may also be included.

The above-described purpose, features and advantages will become clearer through the following detailed description in conjunction with the accompanying drawings, and accordingly, those skilled in the art will be able to easily implement the technical idea of the present invention. There will be. Additionally, in carrying out the present invention, if it is determined that a detailed description of known techniques related to the present invention may unnecessarily obscure the gist of the present invention, the detailed description will be omitted.

The terms used in this application are only used to describe specific embodiments and are not intended to limit the invention. Singular expressions include plural expressions unless the context clearly dictates otherwise. In this application, terms such as “comprise” or “have” are intended to designate the presence of features, numbers, steps, operations, components, parts, or combinations thereof described in the specification, but are not intended to indicate the presence of one or more other features. It should be understood that this does not exclude in advance the possibility of the existence or addition of elements, numbers, steps, operations, components, parts, or combinations thereof.

Hereinafter, preferred embodiments of the present invention will be described in more detail with reference to the attached drawings. In order to facilitate overall understanding when describing the present invention, the same reference numerals are used for the same components in the drawings, and duplicate descriptions for the same components are omitted.

As used in this specification, 'mail' refers to electronic mail, web mail, e-mail, Terms such as e-mail can be used collectively.

1 is a conceptual diagram showing the entire system according to an embodiment of the present invention.

Referring to Figure 1, a system according to an embodiment of the present invention includes a service providing device 100, a user terminal 200, and a mail server 300.

More specifically, the service providing device 100, the user terminal 200, and the mail server 300 can be connected to one or more of wired and wireless channels through a connection to a public network to transmit and receive data. The above-mentioned public network is a communication network built and managed by the state or a telecommunications carrier, and generally includes a telephone network, data network, CATV network, and mobile communication network, and provides connection services so that an unspecified number of ordinary people can access other communication networks or the Internet. . In the present invention, the public network is replaced with network.

Additionally, the service providing device 100, user terminal 200, and mail server 300 may include respective communication modules for communicating using protocols corresponding to each communication network.

The service providing device 100 can be connected to each user terminal 200 and the mail server 300 through a wired/wireless network to provide mail security and diagnosis services, and devices or terminals connected to each network are preset. Mutual communication can be performed through network channels.

Here, each of the above networks is a local area network (LAN), a wide area network (WAN), a value added network (VAN), a personal area network (PAN), and a mobile communication network ( It can be implemented with any type of wired/wireless network, such as a mobile radio communication network or satellite communication network.

The service providing device 100 described in this specification provides a mail security service that can detect and block attacks that cause execution of unintended programs through mail, deterioration of the data processing ability of mail-related systems, phishing scams, etc. can do.

Furthermore, the service providing device 100 provides targeted email security threat information configured according to the performance of a targeted email security threat check of incoming mail and targeted email security threat information configured according to the performance of a targeted email security threat check of outgoing mail. By synchronizing, constructing security threat information synchronization data, and using the security threat information synchronization data to perform a targeted email security threat check corresponding to the newly received mail or the new sent mail, A mail security service that performs targeted email security threat response processing according to the targeted email security threat inspection of outgoing mail can be provided.

Here, the targeted email security threat scan corresponding to the newly received or newly sent email includes spam attack threat screening targeting a specific email account using the security threat information synchronization data, malicious code email attack threat screening, and social threat screening. It may include at least one of an engineered email attack threat scan and an email information leakage threat scan, and processes targeted email scans according to a predefined step-by-step scan process in response to the security level, and the processed scan data is the security threat information. It can be used to update synchronization data.

In addition, the service providing device 100 uses security threat information synchronization data and targeted email inspection processing information to perform an email diagnosis process based on quantitative analysis of email security threats responding to targeted email attacks, A mail diagnosis service that provides diagnostic reporting based on the diagnostic process can be provided to each email system user terminal 200.

And the user terminal 200 described in this specification includes a personal computer (PC), a laptop computer, a mobile phone, a tablet PC, a personal digital assistant (PDA), and a portable multimedia player (PMP). ), etc. may be included, but the present invention is not limited thereto, and may be a device that can be connected to the service providing device 100 and the mail server 300, etc. through a public network or private network.

In addition, each device may be a variety of devices capable of inputting and outputting information through application operation or web browsing. In particular, in general, user terminals 200 may be connected to the service providing device 100 through an individual security network.

Meanwhile, the mail server 300 is a system that relays and stores e-mail contents so that a user can send an e-mail written through the user terminal 200 or receive an e-mail written by the other party through the user terminal 200. The mail server 300 can communicate with each other using a preset protocol according to the purpose of processing mail reception and transmission.

In general, the above protocols may include POP3 (Post Office Protocol 3) and IMAP (Internet Message Access Protocol) when processing mail reception. Additionally, the protocol may be SMTP (Simple Mail Transfer Protocol) used when sending and processing mail. In this way, the mail server 300 may be configured and operate as a server system for sending and receiving mail. Additionally, the mail server 300 can be divided into a mail receiving server and a mail sending server to provide respective functions.

Figure 2 is a block diagram for explaining a service providing device according to an embodiment of the present invention, and Figures 3 and 4 are block diagrams for explaining in more detail some configurations of a service providing device according to an embodiment of the present invention. .

First, referring to FIG. 2, the service providing device 100 according to an embodiment of the present invention includes a control unit 110, an inspection data collection unit 120, a targeted email security threat inspection unit 130, and security threat information. It includes a synchronization processing unit 140, an incoming mail processing unit 150, an outgoing mail processing unit 160, a record management unit 170, a diagnostic reporting unit 180, and a communication unit 125.

The control unit 110 may be implemented with one or more hardware processors to overall control the operation of each component of the service providing device 100.

The communication unit 125 may include one or more communication modules for communicating with a network where the user terminal 200 or the mail server 300 is located.

The inspection data collection unit 120 may collect mail information transmitted and received between one or more user terminals 200 through the mail server 300. The mail information may include email header information, email title, email content body, number of receptions over a certain period of time, etc.

Specifically, the email header information includes mail sending server IP address, mail sending server host name information, sender mail domain information, sender mail address, mail receiving server IP address, mail receiving server host name information, recipient mail domain information, and recipient mail. It may include address, mail protocol information, mail reception time information, mail sending time information, etc.

Additionally, the email header may include network path information necessary in the process of sending and receiving mail, protocol information used between mail service systems for mail exchange, etc.

Additionally, the mail information may include the extension of the attached file, hash information of the attached file, the attached file name, the body of the attached file content, and URL (Uniform Resource Locator) information. The attached file may contain additional content to convey additional information or request a response to the information in addition to the content of the email body that the sender wishes to convey to the recipient.

The content may provide text, images, videos, etc. The recipient can check the content by running the application corresponding to the file attached to the email. Additionally, recipients can download and store and manage files attached to emails to a local storage device.

The extension of the attached file can distinguish the format or type of the file. The extension of the attached file can generally be classified into a string indicating the file's attributes or the application that created the file. For example, text files can be classified by extensions such as [file name].txt, MS Word files by [file name].doc(docx), and Hangul files by [file name].hwp. Additionally, image files may have extensions such as gif, jpg, png, and tif.

Additionally, executable files, which are computer files that perform instructions according to coded commands, include [file name].com, [file name].exe, [file name].bat, [file name].dll, [file name].sys, [ [File name].scr, etc.

The hash information of the attached file can ensure the integrity of the information by confirming forgery and alteration of the information. Hash information or hash values can be mapped to arbitrary data of arbitrary length into a bit string of a certain length through a hash function.

Through this, the hash information output through the hash function for the initially created attached file has a unique value. Conversely, the output hash information or hash value has a one-way nature that makes it impossible to extract data input to the function. In addition, the hash function can guarantee collision avoidance, which is computationally impossible for another input data that provides the same output as the hash information or hash value output for one given input data. Accordingly, when the data in the attached file is modified or added, the output value of the hash function is returned differently.

In this way, the unique hash information of the attached file can be used to check whether the file has been modified or forged by comparing the hash information or hash value of the file sent and received through email. Additionally, since the hash information is fixed to a unique value, it is possible to take proactive quarantine measures by utilizing reputation information, which is a database of past history of files created with malicious intent. Additionally, the hash function can be used in technologies and versions that can guarantee one-way and collision avoidance.

For example, hash information can be used as search information for the presence or absence of malicious code in a file through the Virus Total website or the Malwares website. You can receive information such as the file provider and the hash value of the file through a website that provides hash information analysis of the file. In addition, search results for file hash information can be judged as more reliable information by cross-checking reputation information determined by global companies that provide multiple IT information security solutions.

The targeted email security threat inspection unit 130 processes step-by-step matching of the mail security inspection process corresponding to the mail information according to a preset targeted email security threat inspection process, and detects the mail by the matched mail security process. Information can be inspected, and mail security inspection information according to the inspection results can be stored and managed.

Here, the targeted email security threat screening process includes spam attack threat screening targeting a specific email account using the security threat information synchronization data in response to new incoming mail or new outgoing email, It may include at least one of a malware email attack threat scan, a social engineering email attack threat scan, and an email information leakage threat scan.

Additionally, these spam attack threats are checked, Malicious code email attack threat scanning, social engineering email attack threat scanning, and email information leakage threat scanning have preset step-by-step priorities according to each security threat type and can be processed sequentially.

Additionally, in the targeted email security threat inspection process, different email security processes corresponding to new incoming mail or new outgoing mail may be determined. Additionally, the inspection target, inspection order, or inspection method of the mail security process may be determined in advance by synchronized security threat information synchronization data.

The targeted email security threat inspection process allocates independently separated processes as resources when mail information for reception (inbound) or transmission (outbound) is transmitted from the user terminal 200, and It can be executed immediately in the inspection area. The flexible resource allocation method can be explained with the concept of virtual space. In the method of allocating resources to the virtual space, the mail security process can immediately process work in the assigned inspection area from sequentially incoming mail information upon completion of processing.

In contrast, environments such as virtual environments and virtual machines where certain processes are assigned with limited processing within one resource require idle time when other processes wait for the specific process to complete when processing a requested task. You can have it. In this process-based analysis method, flexible resources can have an advantage in processing speed and performance compared to fixed resources.

The targeted email security threat inspection unit 130 can classify mail for reception or sending purposes according to the mail information collected by the inspection data collection unit 120. Afterwards, the targeted email security threat inspection unit 130 can obtain targeted email security inspection information for each mail by matching and analyzing the mail security processes sequentially or based on a set priority.

Here, the targeted email security threat inspection unit 130 can inspect not only email threat types using malicious code but also types of attacks without malicious code. Specific types of targeted email attacks include not only malware attacks, but also social engineering attacks such as impersonation and account takeover, which can also include unintentional or intentional information leak attacks.

Accordingly, the targeted email security threat inspection unit 130 includes a spam attack threat inspection unit 131, a malicious code attack threat inspection unit 133, and a social engineering attack threat inspection unit 135 to detect each type of attack in stages. and an information leak inspection unit 137.

Here, the targeted email security threat inspection unit 130 may use the security threat information synchronization data preconfigured in the security threat information synchronization processing unit 140.

To this end, the security threat information synchronization processing unit 140 provides targeted email security threat information configured according to the performance of a targeted email security threat check of incoming mail, and targeted email security threat information configured according to the performance of a targeted email security threat check of outgoing mail. By synchronizing security threat information, you can configure security threat information synchronization data.

Here, the security threat information synchronization data may include malicious file information and identification information on malicious accounts collected from each inspection process and an external security server, and may include a target configured according to the performance of a targeted email security threat inspection of incoming mail. It can be configured by synchronizing type email security threat information and targeted email security threat information configured according to the performance of targeted email security threat inspection of outgoing mail.

For example, the security threat information synchronization data may include file information that was scanned as having a high malicious threat level in a targeted email security threat scan of a specific incoming email, or sender account information that was scanned as having a high possibility of impersonation or account takeover. You can.

In addition, the security threat information synchronization data may include file information that was inspected as having a high information leakage threat level in a targeted email security threat inspection of a specific outgoing mail, or recipient account information that was inspected as having a high possibility of impersonation or account takeover. You can.

Additionally, the security threat information synchronization data may include similar domain inspection information including email account and domain information detected to be associated with a similar domain attack.

Additionally, the security threat information synchronization data may include account takeover attack inspection information including email account and domain information detected to be associated with the account takeover attack.

In addition, the security threat synchronization data includes zero-day URL attack inspection information that changes the redirection path information of the URL link after the email receipt date, and malicious attacks that use the system security vulnerability after it is discovered and before a patch to prevent it is released. May include zero-day malware scanning information to address code or hacking attacks.

Additionally, the security threat synchronization data may further include delivery routing information including email server information, destination information, and sender information.

Furthermore, the security threat information synchronization data can be continuously updated using inspection data processed in each processing unit of the targeted email security threat inspection unit 130, thereby providing integrated security of the sending and receiving security systems. It is manageable and can effectively prevent internal system damage or information leakage to the outside due to targeted email attacks.

This security threat information synchronization data is information inspected in each security inspection process to be described later, and includes unknown malicious code information, attachment malicious code information, URL malicious code information, header forgery information, similar domain information, account takeover information, and URL. Examples may include phishing information, intentional information leakage information, unintentional information leakage information, and unauthorized email server access information.

To perform this inspection process and configure security threat information synchronization data, first, the targeted email security threat inspection unit 130 may include a spam mail inspection unit 131.

If the mail security process is a spam mail security process, the spam mail inspection unit 131 combines the mail information, including mail header information, mail title, mail content body, number of receptions during a certain period, etc. with preset spam indicators and step-by-step spam indicators. You can match with .

Here, the spam mail security threat may include a type of mail that is indiscriminately distributed unilaterally and in large quantities to an unspecified number of people for the purpose of advertising and promotion between unrelated senders and recipients. Additionally, large amounts of spam mail can place a load on the data processing capacity of the mail system, which may cause the system's processing capacity to deteriorate. Additionally, there is a risk that spam emails may unintentionally connect users to indiscriminate information contained in the content and may be disguised as information for potential phishing scams.

Accordingly, the spam mail inspection unit 131 can use mail information, including mail header information, mail title, and mail content body, as a check item in the spam indicator by checking a certain pattern that can be classified as spam mail. Through this, the spam mail inspection unit 131 can acquire, store, and manage spam mail inspection information by matching the spam indicators step by step.

In addition, the targeted email security threat inspection unit 130 may further include a malicious code attack threat inspection unit 132.

Malicious code can access the memory of the victim's computer system and damage or delete files and programs. Here, malware attacks that are subject to targeted email security threat inspection can be broadly divided into three types. As can be seen, the malware attack threat inspection unit 133 can check the synchronized security threat information synchronization data for performing the inspection process for each attack type, and sends the inspection data according to the inspection results to the security threat information synchronization processing unit 140. It can be processed again to update the security threat information synchronization data.

First, the type of attack for unknown malicious code refers to an attack using new, unknown malicious code that is difficult to detect in anti-virus tests because it is not registered in the big data database. For example, attackers exploit zero-day vulnerabilities to distribute malicious code by redirecting the access path of URL links or attachments in emails after a certain time, not on the day of sending, to create new malicious code that cannot be detected by security solutions. You can insert an attachment containing code and send an email encouraging users to click.

Additionally, malware attacks in attachments are a type of threat in which attackers hide malicious code inside files that attackers usually send by email. Attachments in these malicious emails include documents, compiled and executable files, and even images and files. It can be disguised as a video file, or it can be an encrypted file using a different extension. Furthermore, attacks using executable files may include forging the sender's address to trick recipients into opening an email containing a malicious document, or inserting malicious code into an image and attaching it to the body of the email.

Meanwhile, a malicious code attack using a URL may be a type of attack that inserts a clickable link containing malicious code into an email with the purpose of luring the user to a malicious website. Malicious URLs can be included in large attachments or in the body of an email, which can also include attacks that cause malicious code to be executed only when delivered, as well as when the user clicks on the URL of the email or regular attachment.

In order to perform the security check process for each type described above, the malicious code attack threat inspection unit 132 further includes the hash information of the attached file, the attached file name, the body of the attached file content, and URL (Uniform Resource Locator) information. Information can be matched step by step with preset malware indicators.

The malicious code attack threat inspection unit 132 detects the attachment file extension, hash information of the attached file, attached file name, etc., which can be confirmed by the attribute value of the attached file, as well as the body of the attached file and the URL (Uniform Resource Locator) included in the content. The information can be used as a malware indicator inspection item. Through this, the malware attack threat inspection unit 132 matches the malware indicators step by step according to each type and item to obtain malware inspection information, stores and manages it through the record management unit 170, and provides security. It can be provided to the threat information synchronization processing unit 140 to process the update of security threat information synchronization data.

The malicious code indicator can be set to a level value through inspection items and inspection based on items included in the mail information at each stage, and each inspection level value can be updated according to the above-mentioned security threat information synchronization data.

For example, the malware indicator Level 1 can match the attachment file name and extension of the attachment included in mail information based on big data and reputation information obtained from security threat information synchronization data. Through this, the Malicious Code Index Level 1 can obtain the evaluated level value as inspection information for Malicious Code Index Level 1. For example, the inspection information of the malicious code indicator level 1 is defined as malicious code in the big data and reputation information when the attachment file name, which is a inspection item, includes 'Trojan' and the extension of the attachment file is 'exe'. If it matches the information, it can be evaluated as '1' in the level values divided into 0 and 1. Through this, the inspection information of Malicious Code Index Level 1 can be obtained as '1'.

Additionally, the malware indicator Level 2 can match hash information of email attachments based on big data and reputation information obtained from security threat information synchronization data. Through this, the evaluated level value can be obtained as inspection information for Malicious Code Index Level 2. For example, the inspection information of Malicious Code Index Level 2 is divided into levels of 0 and 1 when the hash information of the attached file, which is a inspection item, is analyzed as 'a1b2c3d4' and matches the information defined as malicious code in the reputation information. The value may be evaluated as '1'. Through this, the inspection information of Malicious Code Index Level 2 can be obtained as '1'.

In the next step, the malware indicator level 3 can match URL (Uniform Resource Locator) information included in the attached file or email content based on URL reputation information obtained from security threat information synchronization data. Through this, the evaluated level value can be obtained as inspection information for Malicious Code Index Level 3. For example, when the inspection information of Malicious Code Index Level 3 is confirmed as 'www.malicious-code.com', the URL reputation information is defined as a harmful site containing malicious code files. If it matches, it can be evaluated as '1' in the level values divided into 0 and 1. Through this, the inspection information of Malicious Code Index Level 3 can be obtained as '1'. And the malware attack threat inspection unit 132 can respond to zero-day attacks that may be omitted from URL reputation information. The malicious code attack threat inspection unit 132 may change the link IP address for a URL without reputation information to the IP address of a specific system and provide the changed IP address to the user terminal 200. When the user terminal 200 attempts to access the URL, it can be connected to the IP address of a specific system changed by the malicious code attack threat inspection unit 132. A specific system that has previously changed the link IP address for the URL can continuously check whether the URL's endpoint contains malicious code.

Meanwhile, the malware attack threat inspection unit 133 allows the administrator to classify and configure emails identified as malicious files through malware classification management using security threat information synchronization data to identify unknown malware. , Accordingly, even if the user requests retransmission, it can be processed to prevent viruses, etc. from being transmitted.

In addition, the malware attack threat inspection unit 133 can perform a multi-analysis test to check for unknown malware, and the multi-analysis test combines a static test and a dynamic test to determine the behavior of the malicious code on the system. By scanning, you can detect new viruses that were not detected in the first scan. Behavioral inspection results can be categorized into, for example, 'forgery', 'memory access', 'hooking warning', 'file creation', 'file deletion', and 'process execution', and the malware attack threat inspection department (133 ) can be used to update the security threat information synchronization data by examining the malware attack threat from the behavioral inspection result information and transmitting the inspection result to the security threat information synchronization processing unit 140.

For example, the malware attack threat inspection unit 133 can perform a virus test consisting of three stages: the first test (vaccine test), the second test (environmental operating system change test), and the third test ( By processing the behavior-based analysis test) in stages, you can check for malware attack threats using the inspection results at each stage.

In addition, the malware attack threat inspection unit 133 regularly checks all incoming (inbound) and outgoing (outbound) email data of users through cloud services in order to perform security threat information synchronization data and big data-based inspection. You can scan to extract malicious attachments that require further inspection.

In addition, the malware attack threat inspection unit 133 can determine whether there is a risk of a targeted email attack based on the security threat information synchronization data and the data constructed as big data in the security threat information synchronization processing unit 140. The big data analysis function can identify and detect even forged extensions (e.g. .doc, .docx, .ppt, .pptx, .pdf, .txt, .rtf, etc.) as targets for malicious code analysis.

Meanwhile, if malicious code in the URL is detected, the malicious code attack threat inspection unit 133 may convert the URL data of the mail information delivered to the receiving mail processing unit 150 into an image. Accordingly, the URL link can be prevented from being opened in a dangerous detection environment where the attached malicious URL is recognized.

In addition, the malware attack threat inspection unit 133 can monitor potential risks through the aforementioned endpoint URL monitoring and continuously track and process the final destination of all URLs in the email body or document file. Here, the malware attack threat inspection unit 133 can track all URLs as interconnected nth URLs. In addition, the malware attack threat inspection unit 133 checks the document file included in the email body from the URL, and in particular, in the case of large attachment files, even for large attachment files that are downloaded by bypassing the URL of the email body, after downloading Any URL to a malicious attachment or document file can be tracked.

In addition, the malware attack threat inspection unit 133 rechecks access to the URL in real time through file and endpoint scanning when the user attempts to click on the URL link after receiving the email, and restricts access when a risk is detected. Testing can be performed. The resulting URL post-testing information can be updated in real time in the security threat information synchronization data, and the incoming mail processing unit 150 and the outgoing mail processing unit 160 refer to the URL post-testing results confirmed by this security threat information synchronization data. Thus, processing such as blocking targeted email attacks and user notifications can be performed.

In addition, the malware attack threat inspection unit 133 can perform image-based filtering to check for malware attacks, which can detect text malicious graphic images configured to avoid text-based filtering or malicious attachment filtering. there is.

In this way, the inspection information obtained in units of malicious code indicator levels through the above malicious code security process can be finally summed ('3') and stored and managed as malicious code inspection information. The aggregated malicious code inspection information is provided to the security threat information synchronization processing unit 140 and can be used to update the security threat information synchronization data.

Meanwhile, the targeted email security threat inspection unit 130 may further include a social engineering attack threat inspection unit 133. The social engineering attack threat inspection unit 133 is executed when the mail security inspection process is a social engineering attack threat security process, and is obtained from mail information based on security threat information synchronization data and preset social engineering attack security threat items. Engineering attack analysis data can be matched by item. The social engineering attack analysis data can be obtained by performing an analysis process for each attack type corresponding to mail information.

For example, the social engineering attack threat inspection unit 133 socializes the incoming mail domain, outgoing mail domain, incoming mail address, outgoing mail address, mail routing, and mail content body information that can be extracted from mail determined to be normal. It can be used as an engineered attack threat check item. Through this, the social engineering attack threat inspection unit 133 can perform a type check for each social engineering attack threat inspection item, and obtain, store, and manage social engineering attack threat inspection information.

More specifically, the social engineering attack threat inspection unit 135 may perform header forgery inspection, similar domain inspection, account takeover inspection, and URL phishing inspection when performing an attack type inspection for each social engineering attack threat inspection item.

The header forgery check may include a check to detect forgery of email headers that would allow an attacker to bypass the mail destination in the user's reply. If the header is forged, there is a risk that an attacker can intercept general user emails that may contain company credentials and personal information.

Accordingly, the social engineering attack threat inspection unit 135 detects and blocks such header forgery attacks in advance through header forgery inspection. According to the inspection information of the social engineering attack threat inspection unit 135, the outgoing mail processing unit 160 may block in advance if the reply email address is different when replying to an incoming mail, or may perform a warning process to the sending user. For this processing, the social engineering attack threat inspection unit 135 may check in advance whether the email communication protocol is authenticated.

In the header forgery inspection, the social engineering attack threat inspection unit 135 verifies whether the sender's email complies with the communication protocol (e.g. SPF, DKIM, DMARC) and detects the forged sender in the email. The address can be detected.

In the header forgery inspection, the social engineering attack threat inspection unit 135 may manage the sender reputation of the IP address and domain and check whether the email address has a trustworthy domain.

For example, to check for header forgery, the social engineering attack threat inspection unit 135 analyzes email header information and determines the sender header value (From: <id@domain>) and the reply address header value (Reply-To) of the inbound email. : You can check if <id@domain>) is different.

Additionally, the social engineering attack threat inspection unit 135 may determine which parts of each header value are different and output step-by-step filtering results as inspection results. For example, in the case of ID forgery, if the 'ID' of the sender header value (From: <ABC@XYZ.com>) and the reply address header value (Reply-To: <BAC@XYZ.com>) are different emails. It may apply to Additionally, in the case of domain forgery, this applies to emails where the 'Domain' of the sender header value (From: <ABC@XYZ.com>) and the reply address header value (Reply-To: <ABC@YXZ.com>) are different. can do. In addition, in the case of address forgery, this may correspond to a case where the sender's address is a different email when replying, and in the case of signature forgery, this may correspond to a case where the signature part of the email content is a different email.

Similar domain checking is to check the type of attack in which an attacker sends a malicious email from an email address. It may include cases where the email address is similar enough to a normal sender to be indistinguishable from the human eye, but is an attacker's malicious domain. For example, the uppercase letter 'I' and the lowercase letter 'l' look similar and can be abused for attacks.

Accordingly, the social engineering attack threat inspection unit 135 can check whether the sender's email address or domain is a similar domain based on accumulated email history, and the incoming mail processing unit 150 notifies the user of the level of risk similarity. You can block the email.

Here, the social engineering attack threat inspection unit 135 uses the email address of the email history accumulated and managed in the security threat information synchronization data, and the new email as a standard for determining whether a new email is a similar email fraud attack and the possibility of a social engineering attack threat. Information on the number of letters that are similar but not identical can be used between email addresses included in the header information. For example, the social engineering attack threat inspection unit 135 determines that the possibility of a social engineering attack threat increases as the number of similar letters that are not identical to each other decreases, and calculates the judgment result as a risk level and outputs it as a test result. .

Additionally, the email security manager can directly register suspected similar email addresses in the security threat information synchronization data, and if the email addresses are similar but only the TLD (top level domain) is different, they can be classified and managed separately.

More specifically, the social engineering attack threat inspection unit 135 determines the domain information included in the header information of the new mail and the accumulated mail history of the security threat information synchronization data synchronized in the security threat information synchronization processing unit 140. By calculating the similarity between domain information, emails from similar domains containing the number of similar letters less than or equal to a specific character (for example, 3 letters) that are generally difficult for users to distinguish can be detected as social engineering attack threat emails.

Accordingly, the incoming mail processing unit 150 or the outgoing mail processing unit 160 blocks reception or transmission of mail, delays reception or transmission of mail, deletes mail, or deletes mail according to the results of the social engineering attack threat test in response to new mail. Targeted email security threat response processing, including sending warning notification messages, can be performed.

For example, the social engineering attack threat inspection unit 135 determines that the TLD (top level domain) of the sender domain of a new received email has some modifications compared to other existing mail history information included in the security threat information synchronization data. , if the string array is partially rearranged, or one of the strings is changed to a similar character or a different character, the social engineering attack threat level can be detected, and the detected threat level is sent to the receiving mail processing unit 150 as a result of the inspection. Can be printed. The incoming mail processing unit 150 may selectively block reception of new incoming mail according to the threat level, process reception delay or deletion, and process user warning notification messages, etc., according to a preset similar domain processing policy.

The similar domain risk level of this social engineering attack threat is divided into five levels as shown below, depending on the degree of change in similar characters that do not match compared to other existing mail history information included in the security threat information synchronization data. It can be.

That is, the social engineering attack threat inspection unit 135 uses the accumulated domain information obtained from the security threat information synchronization data by performing the similar domain check, and determines the sender domain included in the newly received mail in the accumulated domain information. You can perform an inspection process that checks whether it is similar to the included domain step by step, and outputs the risk level of similar domain attacks of social engineering attack threats divided into five stages as the inspection result as shown below. You can.

TLD level: When the last segment of the email domain (e.g. .com, .net, .org, etc.) is changed to a similar character.

Low level: The email address alphabet has changed to three or more similar, distinguishable characters.

Normal level: When the email address alphabet has been changed to two similar, distinguishable characters.

High level: When the email address alphabet has been changed by 1 character with a similar, distinguishable character.

Risk level: The email address alphabet consists only of similar characters that are difficult to distinguish (for example, l (lowercase el) and I (uppercase i))

According to this configuration, the social engineering attack threat inspection unit 135, through the step-by-step inspection process, counts similar characters of similar domains that are detected as similar and do not match the domains included in the accumulated domain information. The level of similarity is calculated step by step, and based on the degree of similarity based on the number of similar characters, the threat level of a similar domain-based social engineering email attack of the new sent mail or new received mail can be determined.

This similar domain-based social engineering email attack threat level information consists of targeted email security threat inspection data of new mail and is delivered to the incoming mail processing unit 150 or the outgoing mail processing unit 160, and the aforementioned mail corresponding thereto. blocking, delaying or deleting, and user alert notification processes may be performed.

Meanwhile, the social engineering attack threat inspection unit 135 may perform an account takeover (ATO) check to detect a social engineering attack threat using an actual user's account.

Through an account takeover attack, an attacker can attempt to log into a stolen email account and then explore the user's email history to find confidential information and potential secondary victims. For example, an attacker can send an email requesting a change to a remittance account using account information stolen from a phishing site or transmit confidential information stored in the account to an external party.

To prevent this, the social engineering attack threat inspection unit 135 according to an embodiment of the present invention uses learning data for each account takeover inspection item obtained from the security threat information synchronization data of the security threat information synchronization processing unit 140. , you can perform an account takeover test to detect threats of social engineering attacks using account takeover.

To this end, the security threat information synchronization processing unit 140 may configure accumulated learning data for each account takeover test item, and according to artificial intelligence model learning processing between the configured learning data and email item data of the actual account takeover case, the new A learning model can be constructed that outputs the possibility of recognizing that the outgoing mail or the new received mail is sent by a stolen account. Here, the artificial intelligence model learning process is a known artificial intelligence deep learning neural network technology, and various known learning technologies such as CNN, DNN, RNN, LSTM, and regression analysis can be applied.

In addition, the social engineering attack threat inspection unit 135 applies the account takeover test item data of the newly sent email or the newly received email to the learning model of the accumulated learning data for each account takeover test item, thereby You can perform a screening process to check whether the email is sent by a hijacked account.

For example, according to the above-described learning model, the security threat information synchronization processing unit 140 can learn the header structure information of mail information for account takeover inspection, and the social engineering attack threat inspection unit 135 can learn the configured header By entering header structure information of new incoming mail or new outgoing mail into the structure learning model, you can check the validity of the account takeover check. This account takeover detection method includes comparative analysis between artificial intelligence-based learning records of past data about emails and current new data.

Additionally, the social engineering attack threat inspection unit 135 may perform an account takeover inspection according to a preset inspection process using not only the learning model but also sender history information.

More specifically, the accumulated learning data for each account takeover test item may include sender history information obtained from the mail header of an incoming or outgoing email, and the account takeover test of the social engineering attack threat inspection unit 135 includes, By comparing the accumulated learning data of the sender history information with the sender location information or sender IP information of the new sent mail or the new received mail, it is determined whether the new sent mail or the new received mail is sent by a hijacked account. It may include an inspection process to check whether or not.

Here, the sender history information includes initial destination information, waypoint information, and final destination information, which are configured based on the mail sending IP and mail server IP, and the account takeover test is performed by: The account from which the new sent mail or the new received mail was stolen by comparing the initial destination information, waypoint information, or final destination information obtained from the header of the new sent mail or the new received mail. It may include an inspection process that checks whether the mail is sent by .

More specifically, if an account takeover occurs, the sender's location or IP address is likely to change. Accordingly, the security threat information synchronization processing unit 140 can cumulatively manage the sender's location information and IP history information by mapping them to the security threat information synchronization data, and the social engineering attack threat inspection unit 135 performs account takeover inspection. , By analyzing the header information of the mail information, it is possible to check whether the sender's location information and IP history information have changed.

Here, the sender's location information and IP history information may include the sender's country information, sender IP address information, and server IP address information. In particular, the header information of the email includes the IP information from which the email was first created and sent (initial destination information), the server IP address to which the email was delivered (waypoint information), and the server that ultimately sent the email. IP (final destination information) may be included.

That is, the email header information is the IP address history of the sending server for mail transmission, and includes initial destination information, transit information, and final destination information. The security threat information synchronization processing unit 140 includes the initial destination information in the security threat information synchronization data. It is possible to cumulatively manage the sender's location information and IP history information, including destination information, transit information, and final destination information, by mapping them.

In addition, the social engineering attack threat inspection unit 135 compares the initial destination information, transit information, and final destination information obtained from each cumulatively managed sender's location information and IP history information with the header information of the new mail to determine the sender's identity. You can check whether your account has been hijacked.

More specifically, for example, a decision to take over an account can be exemplified as follows.

- In case of changing the initial destination: The initial destination of the sender location and IP of the email included in the header information of the new email (IP address of the mail server from which the first email was requested) is changed to each cumulative managed sender's location information and IP history. If the country is identified as changed and different from the information (e.g., the cumulative managed sender's initial destination is 1.1.1.1 (Country A) and the final destination is 2.2.2.2 (Country A), the header of the new mail will be the initial destination. If the destination is 3.3.3.3 (Country B) and the final destination is 2.2.2.2 (Country A)

- In case of final destination change: The final destination of the email sender location and IP included in the header information of the new email (the IP address of the mail server that last sent the email) is combined with each accumulated and managed sender location information. If it is identified as a changed country that is different from the IP history information (e.g., the cumulatively managed sender's transit point is 1.1.1.1 (Country A) and the final destination is 2.2.2.2 (Country A), the header of the new mail contains the transit point. is 3.3.3.3 (Country B), and the final destination is changed to 3.3.3.3 (Country B))

Accordingly, the social engineering attack threat inspection unit 135 may perform an account takeover attack inspection and transmit the inspection results to the incoming mail processing unit 150 and the outgoing mail processing unit 160.

For example, if the current location of the sender is different from the previously received email, the outgoing mail processing unit 160 may warn the user of the account takeover test results or block the outgoing email. Additionally, if the IP address of the received email server is different from the previously received email, the receiving mail processing unit 150 may warn the user of the result of an account takeover test or block the email. Furthermore, if the current email has a different sending path from a previously received email, the receiving mail processing unit 150 may warn the user of the result of an account takeover test or recommend blocking the email. Additionally, the social engineering attack threat inspection unit 135 may perform an inbound management function to block emails according to a specific band or IP band.

Meanwhile, the social engineering attack threat inspection unit 135 may further perform URL phishing inspection. URL phishing is an attack in which an attacker creates a phishing page or website to steal the victim's ID and password and induces the victim to enter account information through a malicious URL or file included in the email.

For example, for phishing inspection, the social engineering attack threat inspection unit 135 tracks the final destination of the URL within the URL when an email user accesses the phishing site and enters the ID and password, and You can check whether a web page that encourages information entry is included.

In this way, through the social engineering attack threat inspection process, the inspection information can be finally summed ('3') and stored and managed as social engineering attack threat inspection information. The combined social engineering attack threat inspection information is transmitted to the security threat information synchronization processing unit 140 and can be used to update, store, and manage the security threat information synchronization data, and the incoming mail processing unit 150 and the outgoing mail processing unit ( 160) and can be used as security threat identification information.

Meanwhile, the targeted email security threat inspection unit 130 may include an information leak inspection unit 137 to respond to internal information leakage security threats. Here, the information leak inspection unit uses the security threat information synchronization data and attribute information of mail information to check whether information is leaked in the outgoing mail, and transmits the inspection information to the outgoing mail processing unit 160 to block the sending, or Approval for transmission of outgoing mail through the mail server 300 may be processed to be rejected.

The information leakage inspection unit 137 can inspect information leakage, especially as a security threat of targeted email attacks caused by transmission by users.

First, the information leakage inspection unit 137 can detect intentional (intentional) information leakage. If the information leak inspection unit 137 matches the specific leak conditions corresponding to intentional (intentional) information leakage set by the security manager in response to the outgoing mail, it transmits the inspection information to the outgoing mail processing unit 160 and sends the mail. You can perform pending or blocking processing. In addition, the outgoing mail processing unit 160 may transmit, to the user terminal 200, a notification message that allows the sender to set a transmission delay time for the outgoing email, a warning notification message, etc., if a specific leakage condition is met. .

In addition, the information leakage inspection unit 137 detects unintentional (unintentional) information leakage and delivers the detection information to the outgoing mail processing unit 160 to block, warn, or delay unintentional information leakage. there is.

The information leakage inspection unit 137 detects cases where a user replies or sends an email address classified as a similar email address in malicious account data obtained from security threat synchronization data, configures unintentional information leakage information, and sends a message. It can be delivered to the mail processing unit 160. The outgoing mail processing unit 160 may provide a warning, automatically block, or delay outgoing mail, depending on unintentional information leakage information.

In addition, the information leak inspection unit 137 converts large email attachments into general attachments to safely transmit large attachments to the external network in a security network where the internal and external networks are isolated, thereby establishing a network connection system. If passed, security risks can be checked to detect unintentional or intentional information leakage corresponding to the large attachment file. This means that, according to a preset email transmission policy, a large attachment file has been converted into a regular attachment file so that it can pass the approval of the network connection system. In this case, a malicious file has been converted to a regular attachment file and inserted into the large attachment file. This may include code scanning, virus scanning, and internal information leakage risk scanning. Here, the internal information leakage risk test may include an internal information leakage risk test that checks whether and how often specific security keywords or specific security phrases are included, according to preset security policy data.

In addition, the information leakage inspection unit 137 performs malware inspection, virus inspection, and internal information leakage risk when restoring a large attachment file converted and transferred from the external network to the internal network in a security network where the internal and external networks are isolated. Inspection can be performed. In particular, this may apply when the encrypted external network path information of a large attachment is attached as URL information, or a web page file that can access the encrypted external network path information of a large attachment is attached as a general attachment. .

In addition, the information leak detection unit 137 can encrypt the contents of the sent mail when the IP address that confirmed the mail, the number of times the mail was opened, etc. satisfy certain conditions, and the number of mails that have been sent can be individually determined. It is desirable that it be processed so that users cannot access it.

Meanwhile, the incoming mail processing unit 150 and the outgoing mail processing unit 160 may process mail status according to the mail security check information and targeted email security threat determination information obtained through analysis of the mail information.

If the targeted email security threat determination information is determined to be an abnormal email, the incoming mail processing unit 150 and the outgoing mail processing unit 160 may determine whether the subsequent mail security process is stopped and process the mail status. Through this, the incoming mail processing unit 150 and the outgoing mail processing unit 160, if a problem is discovered in the inspection step first according to priority, performs only the necessary processing at that step and determines whether the inspection is completed to perform the subsequent inspection step. can be terminated without execution. Through this, the efficiency of mail security services can be secured, reducing system complexity and improving processing efficiency.

The mail security inspection information is information obtained by combining spam mail attack threat inspection information, malware attack threat inspection information, social engineering attack threat inspection information, and information leakage inspection information calculated by the targeted email security threat inspection unit 130. You can use . For example, the targeted email security threat inspection unit 130 performs a inspection process on mail information, and the score calculated with the spam mail inspection information is '3' and the score calculated with the malicious code attack threat inspection information is '3'. If the score calculated from '2', social engineering attack threat inspection information '1', and government leaked attack threat inspection information is '0', the score combined with targeted email attack threat inspection information can be obtained as '7'. there is. At this time, based on preset security threat identification information, if the overall score is in the range of 0-3, it can be classified as normal mail, if it is in the range of 4-6, it can be classified as gray mail, and if it is in the range of 7-12, it can be classified as abnormal mail. Accordingly, an email with the mail security check information of '7' may be determined to be an abnormal email. In addition, the result value of each inspection information item included in the mail information inspection information may be assigned an absolute priority depending on the item or may be prioritized according to weight.

And, as shown in FIG. 4, the reception mail processing unit 150 is a mail distribution processing unit that processes mail determined as normal mail according to the security threat determination information into a reception or sending state that can be processed by the user terminal. It may include (151).

In addition, the received mail processing unit 150 may further include a mail discard processing unit 152 that processes mail determined as abnormal mail according to the security threat determination information in a state in which the user terminal cannot access the mail.

Additionally, the received mail processing unit 150 converts the gray mail into non-executable file content for mail determined to be gray mail according to the security threat determination information and allows the user terminal to selectively process the mail status. It may further include a mail detoxification processing unit 153 provided.

In general, the gray mail can be classified as spam mail or junk mail, or conversely, it can be classified as normal mail. In the present invention, the gray mail can be defined as a type of mail that is distinguished when the security threat determination information is calculated as an intermediate value within a certain range that cannot be determined as normal or abnormal. The mail detoxification processing unit 153 can convert gray mail containing the body of suspicious content into an image file and provide the mail in a state that can be checked by the user terminal 200. Additionally, the mail detoxification processing unit 153 can remove or modify sections suspected of being malicious code in the attached file and provide the file to the user terminal 200.

Furthermore, the mail distribution processing unit 151, mail discard processing unit 152, and mail detoxification processing unit 153 can perform the same process on outgoing mail processed in the outgoing mail processing unit 160.

Meanwhile, the outgoing mail processing unit 160 includes an outgoing mail approval system linking unit 161 and an outgoing mail filtering processing unit 161.

The outgoing mail approval system linkage unit 161 requests the mail approval system connected to the mail server 300 to reject mail approval when a security threat such as a targeted email attack such as information leakage is determined from the mail information of the outgoing mail. You can send messages or process warning notifications.

Here, the outgoing mail approval system linkage unit 161 may be configured to transmit an email notifying the user of each processing status information when the security manager approves, rejects, or suspends the approval request through the mail approval system.

For example, in an email approval system, if a specific keyword and attachment file type set by the administrator are included, approval can be determined according to the organization chart. In this case, the outgoing mail approval system linkage unit 161 configures processing status information, including whether the administrator allows or rejects email transmission, into an email when a specific keyword requiring approval among the title, attachment, or file extension is detected. So, it can be sent to the sender’s account.

Furthermore, the outgoing mail approval system linkage unit 161 may set a limit on the maximum number of emails that can be sent at once by limiting email transmission to the mail approval system. The outgoing mail approval system linkage unit 161 can maintain the status of the email server and account security by limiting the number of users who can send emails per day and the number of recipients per email.

In addition, the outgoing mail filtering processing unit 161 may perform filtering processing such as discarding or rendering harmless the outgoing mail when a security threat of a targeted email attack such as malicious code is determined from the mail information of the outgoing mail. there is.

For example, when the outgoing mail processing unit 160 determines that the outgoing mail requested to be sent is a targeted email security threat, the outgoing mail processing unit 160 includes a link to preview the harmless and filtered email instead of sending the actual email to the email recipient. Secure email can be sent.

In addition, the outgoing mail processing unit 160 can process a follow-up management service that responds to security threats of targeted email attacks on outgoing mail even after the user sends the mail. The post-management service is limited to processing by a special account such as an administrator, and the outgoing mail processing unit 160 verifies the recipient's access and inquiry for email security and verifies the recipient's secure email access IP through the post-management service. , you can check the recipient's secure email access date and time, and process the recipient's access control (allow/block) to the secure email.

In addition, the outgoing mail processing unit 160 can perform log monitoring and notification of malicious account information obtained from security threat synchronization data, and the monitored log includes ID, location (country), IP address, date, status ( may include detailed log information such as success or failure).

The outgoing mail processing unit 160 reports the results of monitoring malicious accounts within the email server by identifying malicious login attempts to the user account, providing a notification to the user terminal, and displaying the notification on the email or dashboard interface. can do.

Meanwhile, the outgoing mail processing unit 160 may process email encryption to prevent intentional information leakage of emails. Email encryption encrypts or disguises the contents of emails and attachments to protect sensitive information from being read by anyone other than the intended recipient.

Additionally, the outgoing mail processing unit 160 may provide outgoing delay, outgoing mail inquiry, and deletion functions to prevent intentional or unintentional information leakage. In order to prevent intentional or unintentional leakage of information by users, the outgoing mail processing unit 160 can set a delay time between the sending time and the delivered time, and can set a delay time between the mail sending time and the delivered time. Shipment may be cancelled. The right to cancel emails within the delay time can be granted to administrators and users. Once a canceled outgoing email cannot be sent, the email must be rewritten.

Additionally, the outgoing mail processing unit 160 may restrict the country of use and IP address corresponding to the account in order to prevent account takeover attacks in advance. To set these restrictions, the outgoing mail processing unit 160 provides a function that allows security managers and email users to register specific accessible IP addresses and countries through 'secure IP registration' or 'allowed country registration'. Accordingly, users can only send emails from permitted IP addresses and countries.

Additionally, the outgoing mail processing unit 160 may block access to the email server in advance for sending unauthorized mail through email server IP access control.

For example, administrators can restrict access to webmail or mail clients, controlling whether email links are allowed in sent emails. For example, the outgoing mail processing unit 160 can block outgoing webmail connections using a registered IP, and controls communication access based on POP3 (client server protocol)/SMTP (mail transfer protocol) to enable mail client Communication-based outgoings can also be blocked.

In addition, the outgoing mail processing unit 160 may configure, store, and manage an email server access restriction log, such as IP address and date, when sending email from a registered IP address and country. Additionally, this email server access restriction log can be used to check whether the user is allowed to send messages during the next connection. The outgoing mail processing unit 160 uses user identification information, encrypted email information, user password information, device identification information, access IP information, access time information, access location information, and communication to the email engine to check whether the user is allowed to send mail. You can check the email server access restriction log containing protocol identification information.

Meanwhile, referring again to FIG. 2, the record management unit 170 may store and manage the mail information processed according to the targeted email attack security threat determination information as record information. When a normal email is processed according to the targeted email attack security threat determination information, the record management unit 170 records the incoming email domain, outgoing email domain, incoming email address, outgoing email address, email routing, and email content body information. The record information contained therein is stored and managed as trust authentication information, and if it is processed as an abnormal email, the record information can be transmitted to the security threat information synchronization processing unit 140 to update the security threat information synchronization data.

In addition, the record management unit 170 includes a learning data processing unit 171 to build a security threat information learning model for blocking targeted email attacks based on learning of the normal email and abnormal email information, The security threat information learning model may be transmitted to the security threat information synchronization processing unit 140 and included in the security threat information synchronization data.

Meanwhile, the diagnostic reporting unit 180 collects processing result information of the targeted email security threat inspection unit 130, configures email security diagnosis service information from the processing result information, and provides an email security diagnosis service to the user terminal 200. can be provided.

More specifically, the diagnostic reporting unit 180 can collect step-by-step matching result information of the mail security process processed by the targeted email security threat inspection unit 130, and one or more quantitative information corresponding to the collected matching result information. The threat level ratio factor for applying classification conditions can be determined.

In addition, the diagnostic reporting unit 180 can calculate quantitative analysis information corresponding to the threat level ratio element from the matching result, and based on the quantitative analysis information, the mail system to be diagnosed and the score for each threat level stage classification for each mail. can be decided.

Accordingly, the diagnostic reporting unit 180 can configure email security diagnostic analysis reporting based on scores for each threat level classification, and the configured email security diagnostic analysis reporting information can be provided to the user terminal 200.

As described above, the targeted email security threat inspection unit 130 can classify and process spam email security threats, malicious code security threats, social engineering security threats, and internal information leakage security threats, and the security threat architecture. The security threat type/level/process/priority/processing order can be set, and the corresponding processing process of the incoming mail processing unit 150 and the outgoing mail processing unit 160 can be performed, and each matching By matching the processing results to various quantitative classification conditions, the number of matches for each threat level ratio element can be calculated. These quantitative classification conditions can also be called threat level element classification criteria.

In addition, the diagnostic reporting unit 180 applies the quantitative analysis information of each threat level ratio element to the score calculation formula for each preset threat level classification, to confirm the degree of comprehensive security threat of the email system to be diagnosed, and to determine the level of the user's response to it. Diagnostic analysis reporting information that can provide response guidance may be configured.

Accordingly, the user terminal 200 can receive the diagnostic analysis reporting information, accurately check the status of email security threats based on security threat architecture based on quantitative actual data, and take action by receiving corresponding guides. It is possible to block increasingly diverse security threats, such as targeted email attacks, in advance.

Additionally, the diagnostic reporting unit 180 may provide a warning message to the user terminal 200 based on diagnostic analysis reporting information. The warning message alerts users to the risk of targeted email attacks using terms such as 'spam', 'similar domain', and 'forged headers' along with the subject of the email in their mailbox, allowing them to identify what type of email it is. Additionally, security administrators can configure suspicious emails to be delivered or not delivered to users, and can also manage warning message words/phrases by group.

Meanwhile, the diagnostic reporting unit 180 can configure preliminary email security reporting information and provide it to the user terminal 200. Pre-email security reporting information can be provided as a notification before the user opens the email and can provide information about the risk of the received email.

This proactive email security reporting information may be displayed individually or as an aggregate threat level in response to at least the following information:

- Receiving history report: Previous receipt history to email address to check similar domains

- Delivery route report: Current delivery route and delivery route change history for email transmission

- Header forgery report: Status of sender header forgery and forgery

- URL inspection report: number of malicious URLs detected

- Similar domains: The risk level of similar domains (e.g. TLD, low, medium, high, and risky)

In addition, the diagnostic reporting unit 180 can configure post-email security reporting information and provide it to the user terminal 200. Reactive email security reporting information is a detailed summary report that allows security administrators or users to be aware of the state of email security and may include investigative and analytical information such as information about the current state of risky mail, including:

- Safety risk assessment: daily number of fraudulent emails, number of attacks received per user account, attack area by country, security rating for current email risks

- Safety risk analysis: Email attack status by attack type (e.g. spam, malware, malicious URLs and attachments, forged headers, similar domains)

- Attack scenarios (e.g. malware, malicious URLs, suspicious sender addresses, forged headers and similar domains, etc.)

In addition, the diagnostic reporting unit 180 may provide a status dashboard interface to the user terminal 200, and the status dashboard interface may provide information that affects the operation of the selected technology entity, such as operating status, configuration, and operating environment. It can provide an overview of the real-time technical status of incoming and outgoing emails.

For example, the status dashboard interface can be configured to display real-time information panels of the entire targeted email attack blocking feature (e.g., total number and status of emails, reasons for inbound and outbound email failures, number of targeted email attacks received), Allows internal security managers to recognize and control.

Accordingly, the diagnostic reporting unit 180 can configure email security diagnostic analysis reporting for targeted email attacks based on scores for each threat level classification, and the configured email security diagnostic analysis reporting information is provided to the user terminal 200. It can be.

In addition, the diagnostic reporting unit 180 applies the quantitative analysis information of each threat level ratio element to the score calculation formula for each preset threat level classification, to confirm and respond to the comprehensive security threat level of the email system and individual emails subject to diagnosis. Diagnostic analysis reporting information that can provide a response guide for users may be configured.

More specifically, the judgment standard for determining the comprehensive security threat level of an individual email can be determined according to the threat level element classification criteria.

The classification conditions of the threat level element classification criteria can be set in response to the risk detection results of each targeted email attack, for example, malware email detection, malware behavior detection, virus detection, ransomware detection, malicious code detection, etc. URL detection, URL detection in the text, URL detection in attached files, header forgery detection, address change detection when replying, ID change detection, domain change detection, ID & domain order change detection, destination change detection, similar domain detection, beware of header forgery It may include at least one of email detection, spam email (advertising, business) detection, and reliability warning email detection.

If each of these classification conditions is met, a score may be assigned to each classification condition, and the final score may be calculated according to calculations such as summation and average of each threat level element classification standard. Accordingly, the diagnostic reporting unit 180 can determine the score for each threat level classification of the email to be diagnosed.

More specifically, the classification conditions may be assigned to each threat level classification, and the quantitative analysis values detected according to the classification conditions may be summed corresponding to each threat level classification, and the summed values may be added to the summed values. Accordingly, a score for each threat level classification may be determined.

For example, threat levels can be classified into first, second, third, and fourth stages according to their risk, and a score for each stage can be calculated and summed.

Furthermore, the diagnostic reporting unit 180 may set a risk weight corresponding to each threat level. The risk weight may be assigned as 10% for the first level, 20% for the second level, 30% for the third level, and 40% for the fourth level.

Accordingly, the diagnostic reporting unit 180 multiplies the score for each threat level by the risk weight and adds up the results, thereby calculating the risk of a targeted email attack security threat of the email to be diagnosed. .

This targeted email attack security threat risk may be mapped to security levels such as A, B, C, D, and E according to preset levels, and according to this mapping, the diagnostic reporting unit 180 may respond to a specific email. Threat level-based guide content that displays the corresponding comprehensive security threat risk as a security level can be configured and provided to email user terminals.

Here, the diagnostic reporting unit 180 can change and calculate the score in real time by reflecting the user's email history information and settings information that are updated in real time, based on the security threat information synchronization data.

For example, if a user performs permission management settings for a specific source country, mail received from that source may be excluded from risk assessment or may be given a risk rating of 0.

This reflection of user settings is intended to diagnose the risk of targeted email attacks when users, such as companies, have customized settings according to their email receiving and sending environments.

In addition, the security threat information synchronization data reflects the results of the target-type email attack risk test of previously sent mail data, and the diagnostic reporting unit 180 detects the sending address, sending country, and detection of the sending mail that is judged to be dangerous. Using malicious code, etc., a targeted email attack risk score can be calculated for each incoming email.

Additionally, in calculating this targeted email attack risk score, each threat level element classification standard can be classified according to category, and a scoring table for each classified category can be built in advance.

For example, the threat level element classification criteria may include email protocols and advertising mail categories, and scores such as advertising-related blocking history of 1 point, warning history of 1 point, and reliability blocking history of 2 points may be assigned.

In addition, for example, the threat level element classification criteria may include a malware category, with 3 points for URL detection (including post-risks such as zero-day URLs), 2 points for malicious links in documents, 1 point for viruses, and 2 points for ransomware. Scores such as 1 point, 3 points for behavior-based detection, etc. can be specified.

In addition, for example, the threat level element classification criteria may include basic symmetry risk categories related to social engineering attacks, and scores such as 2 points for address forgery, 1 point for ID forgery, 1 point for domain forgery, and 3 points for other forgery. can be specified.

In addition, for example, the threat level element classification criteria may include an advanced impersonation risk category related to social engineering attacks, with 1 point for initial origin risk, 2 points for final origin risk, 3 points for other origin risk, and 3 points for similar domain risk. A score may be assigned, such as 3 points for risk, 2 points for high, 1 point for middle, 1 point for low, and 2 points for TLD (high level domain).

The diagnostic reporting unit 180 calculates an email risk score for blocking such targeted email attacks, maps the security level for the targeted email attack, configures the mapped security level information into guide content, and sends it to the user terminal. can be provided. For example, the diagnostic reporting unit 180 may configure guide content as a text or image marker and insert it at a point adjacent to the email subject or at the start of the email body.

In addition, the diagnostic reporting unit 180 determines whether the total targeted attack risk score for each item is greater than or equal to the first threshold, the targeted attack risk score for a specific item is greater than or equal to the second threshold, or the total targeted attack risk score for each item is greater than or equal to the first threshold. 3 It is determined that the period above the threshold continues for more than a certain period of time or the total number of emails with the total target attack risk score for each item is above the third threshold is more than a certain number within a certain period of time. If each condition is determined, the received mail processing unit ( 150) or a warning notification may be provided to the outgoing mail processing unit 160. The incoming mail processing unit 150 or the outgoing mail processing unit 160 may process an administrator notification corresponding to a warning notification mail or automatically block mail.

Accordingly, the user terminal 200 provides targeted email security threat information configured according to the performance of a targeted email security threat check of incoming mail, and targeted email security threat information configured according to the performance of a targeted email security threat check of outgoing mail. You can accurately check the status of targeted email security threats calculated based on synchronized security threat information synchronization data based on quantitative actual data for each mail and system, and take action by receiving a corresponding guide to target email security. It is possible to block increasingly diverse security threats in advance.

Referring to FIGS. 5 and 6 , FIG. 5 first relates to a targeted email attack threat inspection process of received mail, and the service providing device 100 collects received mail information (S101).

In addition, the service providing device 100 uses the security threat information synchronization data to perform a targeted email security threat check in response to newly received mail, and the targeted email security threat check includes spam threat check (S103) and malware. Multi-level inspection at each stage, such as attack threat inspection (S105) and social engineering threat inspection (107), can be performed.

Here, malware attack threat inspection may include targeted email attack threat inspection such as unidentified malicious code, attachment malicious code, and URL malicious code, and social engineering threat inspection includes header forgery, similar domains, account takeover, and URL phishing. May include testing.

Thereafter, according to the test results, the service providing device 100 may perform user diagnostic reporting (S109) and determine export to or block mail server based on the test results (S111).

Furthermore, the service providing device 100 may configure a warning notification message corresponding to export, blocking, or delay and provide it to the administrator's user terminal 200 or the recipient terminal 20.

In addition, each scan result is synchronized with the targeted email security threat information configured according to the performance of the targeted email security threat inspection of incoming mail and the targeted email security threat information configured according to the performance of the targeted email security threat inspection of outgoing mail, It may be configured as configured security threat information synchronization data (S113).

Meanwhile, Figure 6 relates to a targeted email attack threat inspection process of outgoing mail, and the service providing device 100 collects outgoing mail information (S201).

Thereafter, the service providing device 100 determines that each test result includes targeted email security threat information constructed according to the performance of a targeted email security threat inspection of incoming mail, and targeted email security threat information constructed according to the performance of a targeted email security threat inspection of outgoing mail. From the security threat information synchronization data in which the email security threat information is synchronized, the security threat information synchronized to date is obtained (S203).

Then, the service providing device 100 uses the synchronized security threat information to perform an information leakage threat check based on the transmission approval system (S205).

Afterwards, the service providing device 100 uses the synchronized security threat information to perform a filtering inspection process on the outgoing mail.

Then, the service providing device 100 uses the inspection result of the outgoing mail to determine whether to export it to the mail server, block it, or delay it (S209).

Furthermore, the service providing device 100 may configure a warning notification message corresponding to export, blocking, or delay and provide it to the administrator's user terminal 200 or the sender terminal 10.

Referring to FIG. 7, the system according to an embodiment of the present invention includes a sender terminal 10, a first mail management server device 300, a mail conversion processing device 30, a service provision device 100, and a network-linked mail. It includes an approval device 500, a mail recovery processing device 250, a second mail management server device 400, and a recipient terminal 20.

More specifically, the sender terminal 10, the first mail management server device 300, and the mail conversion processing device 30 may form a secure network separated by an internal network. A security network with a separate network is a network that can transmit mail to an external network only through the network-connected mail approval device 500, and for this, a secured internal network and security devices based on various network interface environments can be built. there is.

To this end, the network-linked mail approval device 500 receives a request for approval of e-mail data to be transmitted to the external network from the first mail management server device 300, which builds a mail server in the internal network, and accepts a preset approval policy and By comparison, only approved and security-verified mail can be processed through a leak check to block targeted email attacks through the service providing device 100, and exported to the second mail management server device 400 through an external network. there is.

Here, the preset approval policy is a complex application of various policies, such as verifying administrator authentication information, confirming approval from a superior in the organization corresponding to the sender, or checking whether e-mail data is vulnerable to security. Approval can be confirmed.

Conversely, when an external user's external mail is received in the internal network through the second mail management server device 400 of the external network, the network-linked mail approval device 500 sends the external mail through the service providing device 100. You can also carry out security checks on attachments and URLs to import only verified emails into the internal network.

Unlike the operation of the internal network system and the network-linked mail approval device 500, the mail recovery processing device 250, the second mail management server device 400, and the recipient terminal 20 located in the external network are operated by the public network ( Through connection to a public network, data can be transmitted and received through one or more of wired and wireless connections. The above-mentioned public network is a communication network built and managed by the state or a telecommunications carrier. It generally includes telephone networks, data networks, CATV networks, and mobile communication networks, and provides connection services so that an unspecified number of people can access other communication networks or the Internet. You can.

Meanwhile, the sender terminal 10, the first mail management server device 300, the mail conversion processing device 30, and the network-linked mail approval device 500 are each configured to communicate using the first protocol corresponding to the internal network. May include a communication module.

In addition, the network-linked mail approval device 500, the mail recovery processing device 250, the second mail management server device 400, and the recipient terminal 20 are each configured to communicate using a second protocol corresponding to an external network. It may include a communication module.

In this way, each internal network separated security network and each device constituting the external network can be connected to each other through wired/wireless networks, and devices or terminals connected to each network communicate with each other through mutually secured network channels. can do.

Here, each of the above networks is a local area network (LAN), a wide area network (WAN), a value added network (VAN), a personal area network (PAN), and a mobile communication network ( It can be implemented with various types of wired/wireless networks, such as a mobile radio communication network or a satellite communication network.

And the sender terminal 10 and the receiver terminal 20 include personal computers (PCs), laptop computers, mobile phones, tablet PCs, personal digital assistants (PDAs), and portable devices (PMPs). Multimedia Player), etc., but the present invention is not limited thereto, and various devices that can be connected to the first mail management server device 300 or the second mail management server device 400 through an internal network, public network, or private network, etc. It can be exemplified. In addition, each of the sender terminal 10 and the receiver terminal 20 may be a variety of devices capable of inputting and outputting information through application operation or web browsing.

Meanwhile, each first mail management server device 300 and the second mail management server device 400 are systems that relay and store e-mail contents so that users can send e-mails written by them or receive e-mails written by the other party. It includes, and communication between devices can be performed using a preset mail protocol depending on the purpose of processing mail reception and transmission.

In general, the mail protocol may be POP3 (Post Office Protocol 3) or IMAP (Internet Message Access Protocol) when processing mail reception. Additionally, when sending and processing mail, the Simple Mail Transfer Protocol (SMTP) or Electronic Mail (EML) protocol may be used. In this way, each of the first mail management server device 300 and the second mail management server device 400 can be configured and operate as a server system for mail transmission and reception processing within each separate network. .

In such a system configuration, the mail conversion processing device 30 according to an embodiment of the present invention may be located in an internal network of a secure network separate from the external network, and may provide link information of large files located in the internal network. After converting the e-mail containing it, receiving a leak check to block targeted e-mail attacks through the service providing device 100, and receiving approval from the network-linked e-mail approval device 500, the e-mail recovery processing device of the external network ( 250) can be processed.

To this end, first, the mail conversion processing device 30 can obtain the transmission mail requested to be transmitted from the sender terminal 10 located in the internal network through the first mail management server device 300, and the transmission mail It is possible to identify link information of a large file located in the internal network and obtain a large file located in the internal network based on the link information.

In addition, the mail conversion processing device 30 can generate a converted mail in which the large file is inserted so that it is classified as a general attachment file of the transmitted mail. This converted mail is generated using the network-linked mail approval device 500. Via this, it can be transmitted to the mail recovery processing device 250 located in the external network.

In this case, the network-linked mail approval device 500 inspects the security risk of the large file inserted to be classified as the general attachment according to a preset mail sending policy, and targets the large file through the service providing device 100. After receiving a leak test to block email attacks, sending of the converted email can be approved, and the approved converted email can be processed before being delivered to the second mail management server device 400, according to an embodiment of the present invention. It can be received by the mail recovery processing device 250 according to.

The mail recovery processing device 250 may be located in an external network separate from the internal network of the security network, and when receiving converted mail converted and transmitted from the internal network through the network-linked mail approval device 500, service After receiving a leak check to block targeted email attacks through the providing device 100, a restored email in which large files in the internal network are restored from the converted email is configured, and the configured restored email is sent to a second mail management server device ( A restoration and delivery process for delivering to the recipient terminal 20 via 400 can be performed.

More specifically, the mail recovery processing device 250 can obtain a large file of the internal network from the general attachment file data included in the converted mail, and separate the large file of the internal network from the converted mail, Upload to a random encrypted external network path.

Then, the mail restoration processing device 250 configures a restored mail of the converted mail by including the uploaded external network path information in the converted mail from which the large file is separated, and the constructed restored mail is managed by the second mail management. It may be delivered to the server device 400 and transmitted to the recipient terminal.

According to this system configuration, large files from the internal network that could not be exported to the external network are processed so that they can be exported through the secure email system. Through this process, the email system security system is utilized as is, while still utilizing the email system security system. A mail service that allows the mail recipient on the external network to easily check large files on the internal network can be implemented.

For example, if the user of the sender terminal 10 of the internal network simply inputs a file to be exported as an email as a large file attachment to a general e-mail, the recipient terminal 20 restores it in the same way as a large file attachment to an outgoing email. Since uploaded large files can be obtained from external network path information included in received mail, actual export of large files can be processed.

In addition, since access rights and access information for large files of such external networks can be managed in the mail recovery processing device 250, it complements the weak security environment in which existing cloud sharing services were inevitably used, and provides a more convenient and Enables safe external network email transmission of internal network files.

Referring to FIG. 8, first, the first mail management server device 300 receives a mail transmission request from the sender terminal 10 and transmits it to the mail conversion processing device 30 (S1001).

Thereafter, the mail conversion processing device 30 identifies internal network link information corresponding to the internal network large attachment file from the mail requested to be transmitted (S1003).

In order to identify internal network link information, the mail conversion processing device 30 according to an embodiment of the present invention first identifies link information (URL or URI) included in the mail requested to be transmitted through the internal network link identification unit 110. You can extract and perform traceability checks on link information.

More specifically, the mail conversion processing device 30, through the internal network link identification unit 110, all link information included in the mail requested to be transmitted or designated link information designated by a preset internal network path (e.g. , link information whose IP address starts with a private IP address set to the internal network) can be extracted, and the extracted link information can be accessed to check whether the file is downloaded and the size of the file.

Accordingly, the internal network link identification unit 110 of the mail conversion processing device 30 identifies the size information of the file to be downloaded among the link information checked as possible for file download, and when the size information is greater than a certain size, It can be identified by link information corresponding to the internal network large-capacity attached file.

For example, the certain size may be 2 megabytes, and the internal network link identification unit 110 may provide link information for downloading an internal network file exceeding 2 megabytes among all link information or designated link information. can be extracted and identified as internal network link information corresponding to the internal network large attached file.

Then, the mail conversion processing device 30 downloads the target file from the internal network link and deletes the internal network large capacity link from the transmitted mail (S1005).

Thereafter, the mail conversion processing device 30 configures EML data by including the target file as an attachment in a general attached mail format in the transmitted mail from which the large link has been deleted (S1007).

Then, the mail conversion processing device 30 requests transmission approval of the EML data-based converted mail from the network-connected mail approval device 500 (S1009).

The network-linked mail approval device 500 may perform targeted email attack inspection processing of large files using the service provision device 100 (S1010) and determine whether to approve the mail based on a preset policy (S1011). ), if approval is rejected, the rejection message is delivered to the sender terminal 10 through the first mail management server device 300 (S1013), and if approval is confirmed, the converted mail is sent to the second mail management of the external network. It is transmitted to the mail recovery processing device 250 connected to the server device 400 (S1015).

Thereafter, the mail recovery processing device 250 separates the target file from the general attachment file of the converted mail, performs a targeted email attack inspection process on the large file using the service providing device 100 (S1016), and general Configure restoration via email (S1017).

Then, the mail recovery processing device 250 uploads the separated target file to a random path (S1019) and configures a web page that allows access to the upload path information (S1021).

Thereafter, the mail recovery processing device 250 adds a web page to the attachment file of the restored general mail (S1023), and sends the restored general mail through the second mail management server device 400 to the recipient terminal ( 20) and forwarded to (S1025, S1027).

In an embodiment of the present invention, the upload path information is illustrated as being added as a web page, but the present invention is not limited to this, and the upload path information may be attached to the restored general mail in various ways, such as link information and URL text. You can.

The method according to the present invention described above can be produced as a program to be executed on a computer and stored in a computer-readable recording medium. Examples of computer-readable recording media include ROM, RAM, CD-ROM, and magnetic tape. , floppy disks, optical data storage devices, etc.

The computer-readable recording medium is distributed in a computer system connected to a network, so that computer-readable code can be stored and executed in a distributed manner. And, functional programs, codes, and code segments for implementing the method can be easily deduced by programmers in the technical field to which the present invention pertains.

In addition, although preferred embodiments of the present invention have been shown and described above, the present invention is not limited to the specific embodiments described above, and the technical field to which the invention pertains without departing from the gist of the present invention as claimed in the claims. Of course, various modifications can be made by those skilled in the art, and these modifications should not be understood individually from the technical idea or perspective of the present invention.

Claims

In the method of operating an email security system,

Security threat information synchronization data is created by synchronizing the targeted email security threat information configured according to the performance of targeted email security threat checks of incoming mail and the targeted email security threat information configured according to the performance of targeted email security threat checks of outgoing mail. configuring steps;

Using the security threat information synchronization data, performing a targeted email security threat check corresponding to new received mail or new sent mail; and

Comprising the step of performing targeted email security threat response processing according to the targeted email security threat inspection of the new received mail or the new sent mail,

Targeted email security threat scanning that responds to new incoming or newly sent emails includes spam attack threat screening targeting specific email accounts, malware email attack threat screening, and social engineering email attack using the above security threat information synchronization data. Contains at least one of the following: threat scan, email information leak threat scan

How email security systems work.
According to paragraph 1,

Further comprising the step of updating the security threat information synchronization data according to the results of the targeted email security threat inspection of the new received mail or the new sent mail.

How email security systems work.
According to paragraph 1,

The security threat information synchronization data is,

URL for malicious code email attack threat inspection Contains final destination tracking inspection information

How email security systems work.
According to paragraph 1,

The security threat information synchronization data is,

Contains at least one of header forgery inspection information for social engineering attack threat inspection, similar domain inspection information, and account takeover inspection information.

How email security systems work.
According to paragraph 1,

The security threat information synchronization data is,

Contains at least one of intentional information leak detection information and unintentional information leak detection information for email information leak detection.

How email security systems work.
According to clause 5,

The step of performing a targeted email security threat check corresponding to the new received mail or the new sent mail,

In performing a targeted email security threat check corresponding to the newly sent mail, determining whether the recipient of the newly sent mail is classified as a fraudulent email address using the security threat information synchronization data. Comprising:

How email security systems work.
According to clause 6,

The step of performing the targeted email security threat response processing is,

If the recipient is classified as a fraudulent email address, automatically blocking the transmission of the new outgoing email or warning the sender.

How email security systems work.
According to clause 5,

The step of performing a targeted email security threat check corresponding to the new received mail or the new sent mail,

In performing a targeted email security threat check corresponding to the newly sent mail, the security threat information synchronization data is used to check the security threats of large attachments that will be converted to regular mail and attached to the newly sent mail according to the mail policy. Containing steps to perform

How email security systems work.
According to clause 8,

The step of performing the targeted email security threat response processing is,

Further comprising the step of approving the conversion of the large attachment to be converted and attached to the regular email according to the security threat check of the large attachment.

How email security systems work.
In a service provision device using an email security system,

Security threat information synchronization data is created by synchronizing the targeted email security threat information configured according to the performance of targeted email security threat checks of incoming mail and the targeted email security threat information configured according to the performance of targeted email security threat checks of outgoing mail. A security threat information synchronization processing unit that configures;

a targeted email security threat inspection unit that uses the security threat information synchronization data to perform a targeted email security threat inspection corresponding to newly received or newly sent mail;

A mail processing unit that performs targeted email security threat response processing according to the targeted email security threat inspection of the new received mail or the new sent mail,

Targeted email security threat scanning that responds to new incoming or newly sent emails includes spam attack threat screening targeting specific email accounts, malware email attack threat screening, and social engineering email attack using the above security threat information synchronization data. Contains at least one of the following: threat scan, email information leak threat scan

A service provision device using an email security system.
According to clause 10,

The social engineering email attack threat check includes a similar domain check that detects social engineering attack threats using similar domains using accumulated domain information obtained from the security threat information synchronization data.

Method of operation of the service provision device.
According to clause 11,

The similar domain check uses accumulated domain information obtained from the security threat information synchronization data to determine, step by step, whether the sender domain included in the new received mail is similar to the domain included in the accumulated domain information without matching it. which includes an inspection process that checks with

Method of operation of the service provision device.
According to clause 11,

The similar domain check uses the accumulated domain information obtained from the security threat information synchronization data to determine whether the recipient domain included in the newly sent mail is similar to the domain included in the accumulated domain information in a step-by-step manner. which includes an inspection process that checks with

Method of operation of the service provision device.
According to clause 11,

The similar domain check uses accumulated domain information obtained from the security threat information synchronization data, and if the recipient or sender domain included in the new sent mail or new received mail does not match the domain included in the accumulated domain information, Including a step-by-step inspection process to check whether they are similar,

The step-by-step inspection process calculates step by step the degree of similarity based on the number of similar characters of similar domains that are detected as similar and do not match domains included in the accumulated domain information,

The step of performing the targeted email security threat check further includes determining a threat level of a similar domain-based social engineering email attack of the new sent mail or new received mail based on the degree of similarity based on the number of similar characters.

Method of operation of the service provision device.
According to clause 10,

The social engineering email attack threat test includes an account takeover test that detects social engineering attack threats using account takeover using learning data for each account takeover test item obtained from the security threat information synchronization data.

Method of operation of the service provision device.
According to clause 15,

The account takeover test uses cumulative learning data for each account takeover test item obtained from the security threat information synchronization data to check whether the newly sent email or the new received email is sent by a hijacked account. including inspection process

Method of operation of the service provision device.
According to clause 16,

The accumulated learning data for each account takeover test item includes sender history information obtained from the mail header of incoming or outgoing mail,

The account takeover test compares the accumulated learning data of the sender history information with the sender location information or sender IP information of the new sent mail or the new received mail, and determines the account from which the new sent mail or the new received mail was hijacked. Includes a checking process to check whether the mail is sent by

Method of operation of the service provision device.
According to clause 17,

The sender history information includes initial destination information, waypoint information, and final destination information, which are configured based on the mail sending IP and mail server IP,

The account takeover test compares the initial destination information, waypoint information, or final destination information obtained from the header of the newly sent mail or the new received mail, and compares the new sent mail or the new received mail. Includes a scanning process to check whether incoming mail is sent by a hijacked account.

Method of operation of the service provision device.
According to clause 10,

According to the results of the targeted email security threat check, further comprising performing diagnostic reporting corresponding to the new received email or newly received email,

The step of performing the diagnostic reporting is,

Based on the results of the targeted email security threat inspection, determining a score for each item corresponding to the threat level element classification criteria.

Method of operation of the service provision device.
According to clause 19,

The step of performing the diagnostic reporting is,

Calculating a targeted email attack email risk score using the scores for each item;

determining a security level corresponding to the targeted email attack email risk score; and

Further comprising configuring guide content according to the determined security level and inserting it into email data.

Method of operation of the service provision device.